DE.CM-4: Malicious code is detected
Subcategory is withdrawn in the next version of this framework and incorporated into: DE.CM-01: Networks and network services are monitored to find potentially adverse events, DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5.2.0
SC-44: Detonation Chambers
Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].
SI-3: Malicious Code Protection
Implement [Assignment (one or more): signature-based, non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures; Configure malicious code protection mechanisms to: Perform periodic scans of the system…
SI-4: System Monitoring
Monitor the system to detect: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives] ; and Unauthorized local, network, and remote connections; Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods]; Invoke internal monitoring capabilities or deploy monitoring devices:…
SI-8: Spam Protection
Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
NIST SP 800-171 Revision 3.0
03.14.02: Malicious Code Protection
Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures. Configure malicious code protection mechanisms to: Perform scans of the system [Assignment: organization-defined frequency] and real-time scans of files from…
03.14.06: System Monitoring
Monitor the system to detect: Attacks and indicators of potential attacks and Unauthorized connections. Identify unauthorized use of the system. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions.
Cloud Controls Matrix v4.0
LOG-01: Logging and Monitoring Policy and Procedures
Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for logging and monitoring. Review and update the policies and procedures at least annually.
LOG-03: Security Monitoring and Alerting
Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.
TVM-02: Malware Protection Policy and Procedures
Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.
UEM-09: Anti-Malware Detection and Prevention
Configure managed endpoints with anti-malware detection and prevention technology and services.
UEM-10: Software Firewall
Configure managed endpoints with properly configured software firewalls.
Critical Security Controls Version 8.1
9: Email and Web Browser Protections
Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct engagement.
9.7: Deploy and Maintain Email Server Anti-Malware Protections
Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.
10: Malware Defenses
Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.
10.1: Deploy and Maintain Anti-Malware Software
Deploy and maintain anti-malware software on all enterprise assets.
10.2: Configure Automatic Anti-Malware Signature Updates
Configure automatic updates for anti-malware signature files on all enterprise assets.
10.4: Configure Automatic Anti-Malware Scanning of Removable Media
Configure anti-malware software to automatically scan removable media.
10.5: Enable Anti-Exploitation Features
Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
10.6: Centrally Manage Anti-Malware Software
Centrally manage anti-malware software.
10.7: Use Behavior-Based Anti-Malware Software
Use behavior-based anti-malware software.
NIST Special Publication 800-53 Revision 4
SI-3: Malicious Code Protection
The organization: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; Configures malicious code protection mechanisms to: Perform periodic scans of the information system [Assignment: organization-defined frequency]…
SI-8: Spam Protection
The organization: Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
NIST Special Publication 800-171 Revision 2
3.14.1: Identify, report, and correct system flaws in a timely manner
Organizations identify systems that are affected by announced software and firmware flaws including potential vulnerabilities resulting from those flaws and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address flaws discovered during security assessments, continuous monitoring, incident response activities, and system…
3.14.2: Provide protection from malicious code at designated locations within organizational systems
Designated locations include system entry and exit points which may include firewalls, remote- access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or…
3.14.3: Monitor system security alerts and advisories and take action in response
There are many publicly available sources of system security alerts and advisories. For example, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) generates security alerts and advisories to maintain situational awareness across the federal government and in nonfederal organizations. Software vendors, subscription services, and industry information sharing and analysis centers (ISACs) may…
3.14.4: Update malicious code protection mechanisms when new releases are available
Malicious code protection mechanisms include anti-virus signature definitions and reputation- based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also…
3.14.5: Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed
Periodic scans of organizational systems and real-time scans of files from external sources can detect malicious code. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways…
Cloud Controls Matrix v3.0.1
AIS-03: Data Integrity
Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.
CCC-04: Unauthorized Software Installations
Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.
TVM-01: Anti-Virus / Malicious Software
Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.
Critical Security Controls Version 7.1
7: Email and Web Browser Protections
Minimize the attack surface and the opportunities for attackers to manipulate human behavior though their interaction with web browsers and email systems.
7.10: Sandbox All Email Attachments
Use sandboxing to analyze and block inbound email attachments with malicious behavior.
8: Malware Defenses
Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.
8.1: Utilize Centrally Managed Anti-malware Software
Utilize centrally managed anti-malware software to continuously monitor and defend each of the organization's workstations and servers.
8.2: Ensure Anti-Malware Software and Signatures Are Updated
Ensure that the organization's anti-malware software updates its scanning engine and signature database on a regular basis.
8.4: Configure Anti-Malware Scanning of Removable Devices
Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.